# buypump.pages.dev — SUSPICIOUS

> buypump.pages.dev identified as a crypto drainer posing as a pump tool with 0/95 VirusTotal detections. Avoid interacting with this site to prevent asset theft.

## Summary
PhishDestroy identifies buypump.pages.dev as a live crypto drainer page currently masquerading under the 'Pump' title. The domain leverages Cloudflare Pages hosting to serve a fraudulent tool claiming to enhance cryptocurrency performance, likely luring victims with false promises of profit. No known drainer kit signature has been extracted yet, but the page’s behavior suggests code execution or malicious wallet connection prompts once users engage with the interface.  This domain resolves to IP 172.66.44.144 and is registered under Cloudflare, Inc., with an SSL certificate issued by Google Trust Services. VirusTotal currently returns 0 detections out of 95 engines, indicating it remains under the radar of most scanning tools. The domain, created via Cloudflare Pages, shows no prior association with known blocklists and has not been flagged by Google Safe Browsing. These technical indicators suggest the threat actor is leveraging legitimate hosting to evade detection.  As of now, buypump.pages.dev remains active and unblocked. Security teams and users should refrain from visiting or engaging with this domain. Immediate action includes adding the domain to browser blocklists and threat intelligence feeds. The risk level remains under investigation, but the absence of detections and active status warrants heightened caution to protect potential victims from crypto asset theft.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: alive (HTTP ?)
- Page title: Pump

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.144

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/518273ce-e5df-46fe-bce8-8b827c5eb6a5
- PhishDestroy: https://phishdestroy.io/domain/buypump.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/buypump.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/buypump.pages.dev/
Last updated: 2026-04-13